CVE-2024-45971

The vulnerability results from lack of data length validation in the handling of MMS IdentifyResponse messages on the MMS client side. A malicious server can send a crafted IdentifyResponse containing data exceeding the stack buffer size, leading to a stack-based buffer overflow. The attack requires no authentication or user interaction — it is sufficient for the client to establish a connection with a malicious MMS server.

An attacker controlling an MMS server can execute arbitrary code (RCE) in the context of the client process, cause application failure, or gain full control over the system regarding confidentiality, integrity, and availability.

Update the LibIEC61850 library to a version containing commit 1f52be9ddeae00e69cd43e4cac3cb4f0c880c4f0 or newer, available in the manufacturer's GitHub repository. Additionally, it is recommended to restrict MMS connections to trusted servers only and to segment industrial networks.

MZ Automation LibIEC61850 in all versions preceding commit 1f52be9ddeae00e69cd43e4cac3cb4f0c880c4f0